A fixed-scope reading of one Microsoft 365 tenant, delivered as documents you keep. Every finding carries the evidence it was decided from, the kind of claim it is making, and what it does not establish. What could not be read is named rather than counted as fine, because an absence of findings and a clean result are not the same thing and only one of them survives being questioned.
When this is worth having
An auditor asks how a control operated across the period. A client's security review asks for the evidence behind an answer you gave. A board asks whether anything changed since the last time. In each of them the question is not what you believe about the tenant; it is whether you can reconstruct how you know. Missing evidence for part of a period is what produces a qualified opinion, and it is the documented cost of not being able to show the working.
What is read, and what is not · What you receive · A specimen assessment
How it runs
One week from access granted. You register an application in your own tenant and grant it read-only consent; no credential of yours ever reaches us beyond that session, and nothing is written back.
Doing it again
A tenant changes, and an assertion about it expires. A second reading can be arranged at the point of sale: what changed since the first, and what cannot be said to have stayed the same.
What it costs
Not established
Not published yet. The price is the one thing on this page that is not established, and inventing a number would be exactly the false precision this product exists to refuse. Ask, and you will get the figure and the scope in writing before anything is run.
Ask about an assessmentTell us which tenant, and what you are trying to be able to show.